Browsium Catalyst Administration Guide

Transcription

1 Browsium Catalyst Administration Guide Version 3.2 Bonding Browsers to Business

2 1 Administration Guide This guide has been created for IT administrators to assist in installing, configuring, and deploying Browsium Catalyst. This version of the guide is designed for use with Browsium Catalyst For more information about Browsium Catalyst, other Browsium products, or to contact Browsium Support, please visit

3 2 Table of Contents 1. Introduction Browsium Catalyst Explained Browsium Catalyst Configuration Manager and Client Installation Catalyst Components System Requirements Installing Browsium Catalyst Client Installing Browsium Catalyst Configuration Manager Available Command Line Switches for the Installer Installation Options Display Options Restart Options Logging Options Repair Options Command Line Installation Examples Upgrading from Evaluation to Licensed Version Catalyst Configuration Manager Overview Menu Bar Project Node Browser Manager Node Add a Custom Browser... 30

4 Rules Manager Node Rule Editor Project Settings Node Configuration Tutorial Create and Test a Project Catalyst Deployment in the Enterprise Understanding Catalyst Registry Setting Locations Working with Test Configurations in Group Policy Environments Multi-user Testing Configurations Managing the Catalyst Client Software Managing the Catalyst Extension for Internet Explorer Enable the Catalyst Add-on for Internet Explorer via Group Policy Disable Internet Explorer s Default Browser Check Managing the Catalyst Extension for Google Chrome Enable the Catalyst Extension for Chrome via Group Policy Disable Chrome s Default Browser Check via Group Policy Managing the Catalyst Extension for Mozilla Firefox Disable Firefox s Default Browser Check via Group Policy Readying Windows 8 and later for Catalyst Set Catalyst as Default Browser for Project Development Set Catalyst as Default Browser for Enterprise Deployment Deploying Catalyst Configurations Project File Deployment Option A: Network Share or Web Server Location Project File Deployment Option B: Client File System Location Verifying Deployment Settings Understanding the Catalyst Project File Caching Process Catalyst Project File Caching Behavior How Catalyst Handles Project File Polling Managing Catalyst Logging Settings A. Troubleshooting... 78

5 4 A.1. Catalyst rule fails to engage A.2. Browser window doesn t get focus automatically A.3. Catalyst did not automatically become the default browser A.4. Catalyst Controller becomes unresponsive... 79

6 5 Section One Introduction In this section you will learn: What is Browsium Catalyst The components which make up Browsium Catalyst What to expect from Browsium Catalyst

7 6 1. Introduction As a rule, the IT department is responsible for determining the standard desktop configuration and web browser for the organization. In the past, most IT groups opted to use Internet Explorer for its flexibility in management as well as IE having been included with Windows. As the web has evolved, pressures have been put on the IT group to offer more browser choice to their users. The challenge of offering choice was complicated by the need for IT to properly manage the alternate browser offerings. Browsium Catalyst is designed to help IT organizations to address these challenges and offer a selection of browser choice to end users all without losing management functionality. Catalyst provides the ability to deliver browser change and still ensure business process remains uninterrupted. Catalyst is more than just about controlling browser behavior. Catalyst is designed to solve IT challenges around legacy web application compatibility issues, challenges around embracing emerging technologies and reducing support costs. Lastly, Catalyst provides the bridge needed for IT to address consumerization in the workplace.

8 Browsium Catalyst Explained Browsium Catalyst is the first multi-browser redirection and management tool of its kind. Unlike other browser redirection engine solutions which have been designed and implemented as part of a vendor specific solution, Catalyst is platform and browser agnostic. By removing any reliance on a specific vendor technology, Catalyst enables an IT organization to be in complete control regardless of how they want to implement the solution. Catalyst provides the ability to safely deploy multiple browsers to end users and still control which browser can be used for a given website or web application. In delivering this level of control, IT organizations finally have a toolset to enable browser choice. Now IT can deliver a multi-browser solution in a manner that makes sense for the organization. Business needs and end user choice are decoupled from web application contingencies, giving IT the flexibility to meet multi-browser requests with confidence. Catalyst makes sense to the user since they have to do nothing special or different; the add-ons do all the switching automatically. The solution is seamless. The end user can focus on doing their work and avoiding problems or downtime. Catalyst is controlled by a hierarchical system of rules, defined using the Catalyst Configuration Manager. Understanding this system is the key to understanding Catalyst. The Configuration Manager provides tools to define criteria by which web applications are loaded in a desired browser. In addition to simply specifying a website to open in a given browser, Catalyst offers the ability to control the user experience when being redirected. For example, some web applications not only need to be opened in a specific browser, but the application requirements are to open each link in a new session. Catalyst can do that with ease. If the requirement is to open content in a new tab, no problem. Catalyst can even block requests entirely, helping provide an extra layer of immediate protection when a security advisory is issued for an exploit on a given browser. Catalyst is designed to keep users where IT wants them to go while not getting in the way when IT hasn t set a policy for a given location. Catalyst enables IT administrators to ensure the right browser is used for the right application, but undefined applications can be accessed with the browser of choice for the user. Catalyst is built on an opt-in basis. In other words, Catalyst intervenes when and only when it is instructed to act.

9 Browsium Catalyst Configuration Manager and Client The Catalyst Configuration Manager is the main interaction point for IT administrators using Catalyst. Catalyst has been designed to work in a traditional IT setting and deploy using existing technology systems in use at your organization. The basic design of the Catalyst Configuration Manager is such that it easily matches the architecture and needs of your organization. Using a distributed solutions approach, web application owners, business units or the IT organization can use the Catalyst Configuration Manager to create rules and configurations for their specific needs; alternatively, a single administrator can manage all the rules and settings. The Catalyst Client includes extensions for three browsers Microsoft Internet Explorer, Google Chrome, and Mozilla Firefox. Catalyst also supports the ability to define and configure additional custom browsers either additional versions of Chrome or Firefox, or an arbitrary browser to set as a target for redirection. Once the Catalyst Client has been installed on a system, the Catalyst Controller process will load at user logon and read the configuration from the system. Catalyst supports both local and Group Policy managed settings to provide the most flexibility and truly deliver an enterprise-ready solution. Once the configuration is loaded, the browser extensions monitor the navigation process for each browser and communicate with the Controller to ensure the correct rule is followed and the appropriate browser is invoked.

10 9 Section Two Installation In this section you will learn: About the Browsium Catalyst components Software requirements for Browsium Catalyst How to install Browsium Catalyst

11 10 2. Installation It s easy to install Browsium Catalyst the software includes two simple MSI packages containing the Catalyst Configuration Manager and the Catalyst Client. Administrators need both the Browsium Catalyst Configuration Manager and the Catalyst Client. End users require only the Catalyst Client. Administrator privileges are required to install Browsium Catalyst, but everything will run using standard user permissions so system access remains tightly control and secure. This section provides details on the specific components of Catalyst.

12 Catalyst Components Browsium Catalyst is comprised of two main parts: a configuration manager tool for defining rules and settings, and a client for interpreting the configurations for end users. The client includes a Controller process and browser extensions for Microsoft Internet Explorer, Google Chrome and Mozilla Firefox. Catalyst Configuration Manager (Catalyst-ManagerSetup.msi) Catalyst Configuration Manager (BrowsiumCatalystManager.exe) is used to create and manage Catalyst configurations (browsers, rules, and settings), which will ultimately be deployed to end user PCs. This application is not intended to be run by end users, so Catalyst-ManagerSetup.msi should not be installed broadly installation of this package should be limited to System Administrators and Web Application/Business Unit owners. Catalyst Client (Catalyst-ClientSetup.msi) The Catalyst Client is responsible for loading Catalyst configuration data and redirecting browser traffic based on that configuration. The client package should be installed on all Catalyst-licensed PCs in your organization. The package consists of two components: o Catalyst Controller The Catalyst Controller (BrowsiumCatalystController.exe) is the main component of the client infrastructure used by Catalyst to handle rules implementation and redirection. The Client consists of a background process/listener service that must be running in order for Catalyst to operate. Without this component, the browser extensions cannot communicate properly and redirection will fail to function properly. o Catalyst Client Extensions for Internet Explorer, Chrome and Firefox Catalyst installs extensions to each browser to enable communication between the browser and the Catalyst Controller.

13 System Requirements The following system specifications are required to run Catalyst. Microsoft Windows o Windows XP o Windows 7 o Windows 8 o Windows 10 o Windows Server 2003 o Windows Server 2008 R2 o Windows Server 2012 R2 Microsoft Internet Explorer 8, 9, 10, or 11 Google Chrome 39 or later Mozilla Firefox 35 or later Microsoft.NET Framework Version 3.5 SP1 or later (full version only) 1 GHz or faster 32-bit (x86) or 64-bit (x64) processor 1MB or more system memory; 2GB when used on multi-user servers

14 Installing Browsium Catalyst Client This section covers manual installation of the Browsium Catalyst Client. You will need Administrator rights to run the Client Installer. Once installed, the Catalyst Client can run under standard user permissions and does not require special permissions or elevation. 1. To start the Client Installer process, simply double-click on the Catalyst-ClientSetup.msi file provided by Browsium. The first screen provides a basic introduction. Click Next to get started. Once the installation process has begun, you will be presented with two installation mode choices. One installs the Catalyst Client software as a 30-Day Evaluation Kit. The second installs the fully licensed version, requiring a license key provided by Browsium. When you have completed your 30-Day Evaluation of Catalyst and are ready to install the License, the process is defined in section 2.6.

15 14 If you have chosen the Licensed Version, you may now enter the license key that has been provided by Browsium and then click Next. The license key can be copied from your Browsium Catalyst Download Page and pasted into the empty box. Your license key is then validated. An invalid license key will result in the following error: If you believe your key is valid, please contact Browsium Support. You may install the 30- day Evaluation Kit now and update the license key later. Be sure to delete the invalid key after clearing the error dialog before clicking Back to the previous screen. 2. The next screen contains the End User License Agreement (EULA) for Browsium Catalyst software. You will need to read and agree to the terms of the EULA in order to proceed.

16 15 3. Select the installation option which best suits your organization. Selecting Typical will install client files to C:\Program Files\Browsium\Catalyst (32- bit systems) or C:\Program Files (x86)\browsium\catalyst (64-bit systems) on the system drive. 4. Now you are ready to install the Catalyst Client. Simply click Install to proceed. The Catalyst Client requires Administrator rights for installation so the installer may generate a UAC prompt before installing. Once installed the Catalyst Client runs using standard user permissions.

17 16 During the process you will see a progress bar: When the Client installation process has finished, you will see the following screen indicating success. To confirm the Catalyst installation has completed properly, launch Internet Explorer and look under Tools->Manage Add-ons to ensure the Catalyst extensions is listed and Enabled.

18 17 Do the same for Chrome and Firefox.

19 Installing Browsium Catalyst Configuration Manager This section covers the installation process for the Browsium Catalyst Configuration Manager. The Browsium Catalyst Client should also be installed on the system for project development. The steps for installing the Catalyst Configuration Manager are as follows: 1. Locate the Catalyst Configuration Manager Installation file (Catalyst- ManagerSetup.msi) and double click to run the program. 2. Confirm you have read and agreed to the End-User License Agreement (EULA) by clicking I agree to the terms in the License Agreement and Next to continue with installation.

20 19 3. By default, the installer places the required files in C:\Program Files\Browsium\Catalyst Manager (32-bit systems) or C:\Program Files (x86)\browsium\catalyst Manager (64-bit systems) on the system drive. Select an installation location and click Next. 4. Now you re ready to install the Catalyst Configuration Manager. Click Install. The Catalyst Configuration Manager installation requires Administrator rights so the installer may generate a UAC prompt before installing.

21 20 5. During the installation process you will see a progress window 6. This screen will be displayed when the installation is complete and all necessary files have been configured. Click Finish and you are ready to begin working with Catalyst.

22 Available Command Line Switches for the Installer Catalyst supports network-based installations using Windows Installer (MSIEXEC.EXE) for organizations that use software distribution systems or want to deploy via installation scripts and logon applications. Catalyst provides for several options that are controlled by the following switches. Note: You must run Command Prompt as Administrator on Windows 7 and above Installation Options Switch /j<u m> <Product.msi> [/t <Transform List>] [/g <Language ID>] </uninstall /x> <Product.msi ProductCode> APPDIR=<path> OPT_PID=<license key> Description Advertises a product m to advertise to all users, u to advertise to the current user Uninstalls the product Installs product to a specific directory, other than the default location Installs with a Catalyst license key Display Options Switch /quiet /passive /q[n b r f] /help Description Quiet mode, no user interaction Unattended mode - progress bar only Sets user interface level, where: n - No User Interface b - Basic User Interface r - Reduced User Interface f - Full User Interface (Default) Shows help information Restart Options Switch /norestart /promptrestart /forcerestart Description Do not restart after the installation is complete Prompts the user for restart if necessary Always restart the computer after installation (the default if no other option is selected)

23 Logging Options Switch /l[i w e a r u c m o p v x +! *] <LogFile> /log <LogFile> Description Install keeping a log file, where: i - Status messages w - Nonfatal warnings e - All error messages a - Start up actions r - Action-specific records u - User requests c - Initial UI parameters m - Out-of-memory or fatal exit information o - Out-of-disk-space messages p - Terminal properties v - Verbose output x - Extra debugging information + - Append to existing log file! - Flush each line to the log * - Log all information, except for v and x options Equivalent of /l* <LogFile> Repair Options Switch /f[p e c m s o d a u v] <Product.msi ProductCode> Description Repairs a product

24 Command Line Installation Examples The following example will install Catalyst-ClientSetup.msi with a Catalyst license key in Quiet Mode with No User Interface. Open the Command Prompt as Administrator, enter the path to Catalyst-ClientSetup.msi (located in C:\Browsium for this example), add the /qn switch, and substitute the hash marks (#) with your Catalyst license key provided by Browsium. The following example will uninstall Catalyst-ClientSetup.msi in Quiet Mode with No User Interface. Open the Command Prompt as Administrator, enter msiexec /uninstall followed by the path to Catalyst-ClientSetup.msi and add the /qn switch. More information on deploying the Catalyst Client to ensure all browser extensions are enabled by default can be found in section Upgrading from Evaluation to Licensed Version You have two options when your 30-Day Evaluation is complete and you wish to upgrade your Catalyst Client software to the fully licensed version: The first is to enter the license key in the Windows registry utilizing a registry editing tool or command line script. You must have administrator rights to edit the registry. For 32-bit systems, the registry key is as follows: HKEY_LOCAL_MACHINE\SOFTWARE\Browsium\Catalyst\Full For 64-bit systems, the registry key is as follows: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Browsium\Catalyst\Full The value is your license key: ####-####-####-####-####-####-####

25 24 The second option is to uninstall the client software with Windows Programs and Features uninstall utility which can be found in Control Panel. Then reinstall Catalyst- ClientSetup.msi, select Licensed Version, click Next. Then enter the license file provided by Browsium and continue with the install process as before. You may also install the Catalyst Client from a command line using the OPT_PID=<license key> switch documented in section 2.5.

26 25 Section Three Introduction to the Catalyst Configuration Manager In this section you will learn: More about the Catalyst Configuration Manager How to manage browsers, rules, and settings in the Catalyst Configuration Manager

27 26 3. Catalyst Configuration Manager Overview The Catalyst Configuration Manager enables you to create and manage rules that define the websites you want to open using the Catalyst system. This section looks at the various elements of the Catalyst Configuration Manager. The Configuration Manager is designed with the look and feel of an MMC snap-in, with three main functional areas: Objects Pane (Left) Tree view enabling access to the Browser Manager, Rules Manager, and Project Settings for a given project Content Pane (Center) Main data and content window Actions Pane (Right) Contextual links and descriptions for common tasks and steps Some data entry fields will display an icon in the lower right hand corner of the text entry field. Clicking this link on any screen will open the extended and powerful text editor. The text editor is provided for easily working with complex text fields, as well as offering syntactical highlighting for easy and readable visual layout. When done editing using the text editor, simply click the OK or Cancel buttons to save (or discard) changes made. The Actions Pane contains regularly used and context related common functions. The Add, Edit, Delete, Copy, Cut, Paste items appear in the Actions Pane based on the specific task being completed. The behavior of these items is the same in all scenarios. Some interfaces may not support items such as Copy and Paste, and will not be displayed. See the Project Node, Browser Manager Node, Rules Manager Node, and Project Settings Node sections for a detailed description of each Objects Pane Node.

28 Menu Bar The Catalyst Configuration Manager Menu Bar provides access to key functions related to creating, editing, and testing Catalyst projects. To aid in configuration testing and tuning, Catalyst Configuration Manager allows project developers to automatically apply project file pointers directly in the system registry and start or restart the Catalyst Controller to process the new configuration. This is performed via Start Test Configuration from the File menu, which writes the file pointer to the LoadFromFileName registry value in HKEY_CURRENT_USER\SOFTWARE\Browsium\Catalyst before starting or restarting the Catalyst Controller. This option reduces delays and overhead of manually editing the registry or deploying registry changes via Group Policy. Open Test Configuration opens the project file found in LoadFromFileName (if Start Test Configuration had been run prior). Clear Test Configuration clears LoadFromFileName in the registry and stops the Catalyst Controller. Start Test Configuration automatically saves the current project before writing the LoadFromFileName registry value and restarting the Controller. If the project has not been saved prior, you will be prompted to save the file to a new location before continuing. You can use the Utilities menu to manage the Catalyst Controller (BrowsiumCatalystController.exe) process. You may need to Start/Stop/Restart the Catalyst Controller to load new configurations or reproduce troubleshooting steps.

29 Project Node The Project node displays the configuration file currently loaded in the Catalyst Configuration Manager. An individual project file (.CAX file extension) contains all of the configuration information needed for a given set of browsers and rules. The Catalyst Configuration Manager is designed to load one project per instance. Loading multiple projects can be done by opening each project in another Catalyst Configuration Manager instance. Browsers and rules can be copied and pasted between projects. Loading a project (or creating a new project) brings up the Project details in the Content Pane. Project details (Name and Description) can be edited on this screen. Projects are assigned a default name and a blank description and should be edited to reflect information and labeling relevant to your organization. The project s File Path is blank until you save the project file. This field cannot be edited, but will be updated automatically if the project is saved to a new location.

30 Browser Manager Node The Browser Manager contains the list of defined browsers for a given system. Catalyst only supports the three preset browsers Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox by default. The Catalyst Configuration Manager will attempt to automatically determine the installation path for each installed browser. If one of the browsers is not installed on the system running the Catalyst Configuration Manager, that entry will remain as an option, but the path will be blank and any attempt to use that browser will result in an error. Selecting a browser and then selecting Edit from the Browser Manager Actions pane will bring up the Browser Editor. For the preset browsers (Chrome, Internet Explorer, and Firefox), you will see four read-only fields and one field (Block Other Requests) which can be toggled between Disabled and Enabled. Custom browsers allow editing of all fields.

31 30 Browser Name This is the name of the browser. Browser names are ready-only for the preset browsers, but can be modified to reflect naming relevant to your organization for custom browsers. Browser Type The Browser Type value is used by Catalyst to identify which type of browser is defined by the setup. This value is required to support multiple browser instances and variations. Setting the Browser Type incorrectly may cause unexpected behaviors. Path to Binaries This is the path location containing the application binaries. Catalyst needs to have the accurate location of the binaries in order to properly load the defined browser when rule conditions are met. Errors in the path location will cause Catalyst to fail to properly load a browser or web content. Paths to preset browsers are always automatically detected. Use of the system variable %ProgramFiles% will ensure that the path to a custom browser works properly on both 32-bit and 64-bit Windows systems. See the example in section Additional Parameters In addition to launching a desired browser, Catalyst can open the browser using additional parameters specified here. Ensure any additional parameters are correct for the specific browser as incorrect items may cause the browser to stop loading. Additional Parameters are often used when creating a custom browser for Google Chrome to launch Chrome in Application Mode (with no address bar or menus). Use the syntax --app=${url} to launch Chrome in Application Mode. Block Other Requests By default, Catalyst is designed to only intervene in content loading and redirection when explicitly defined by a rule. Setting this option will prevent the user from loading any content in the specified browser unless the content matches a rule. Use caution when setting Block Other Requests to Enable, as users may become confused when the browser redirects any address entered that does match rules targeted for that browser Add a Custom Browser Selecting Add from the Browser Manager Actions pane enables the addition of a custom browser. Custom browsers are typically Target Browsers only, meaning that they can be the destination browser for a rule, but cannot process rules themselves because they don t have a Catalyst browser extension. Examples include Opera and Safari, which would be set as Type = Custom.

32 31 However, a custom browser can be created of type Google Chrome and be capable of processing rules. This is typically done to launch Chrome with special parameters, such as Application Mode or Kiosk Mode. The following example configures a custom browser named Chrome App Mode, launching Chrome in Application Mode. Although the Type is still Custom, Catalyst recognizes Google Chrome as the binary and allows rules to be processed.

33 Rules Manager Node The Rules Manager is the main interface for creating, editing and managing evaluation criteria which Catalyst uses to determine which browser opens each web application. This section contains details on the various elements of this interface. The Rules Manager shows the hierarchical rules list that Catalyst uses to determine what (if any) action to take when a web address is entered. The heading for each column in this window refers to the specific rule element for a given rule. The Rules Manager Actions pane will display the 4 available options for managing rules. Add To create a new rule, click the Add link in the Actions Pane to bring up the Rule Editor window. The next part of this section provides details on the options and values in the Rule Editor window. See the How to Create a Rule Section for details on creating rules. Edit Rule - URLs and rule definitions can be complex, and complexity may lead to typographical errors. In the event you make a mistake or need to revise a rule, simply double click the line to edit (or highlight the line and click the Edit Rule link in the Actions Pane) to make the necessary changes.

34 33 Delete Rule - To delete a rule, select it from the Rules Manager Window, then click the Delete Rule link in the Actions Pane. To disable a rule, rather than remove it, uncheck the Enable checkbox. Copy To copy a rule, select the item from the Rules Manager Window and click Copy in the Actions Pane. Cut - To cut a rule (which copies the item to the clipboard rather than delete it entirely), select the item from the Rules Manager Window and click Cut in the Actions Pane. Paste The Paste item in the Actions Pane can be used to paste items from the clipboard to the currently loaded, active project. For example, you can Copy/Paste items within a single project or Copy from one project and Paste into another. Move Rule Up/Move Rule Down - By default, rules are ordered in the sequence they are added. Since rules are evaluated in the order they are stored, the sequence of rules can be critical to the proper functionality of your web application in Catalyst. To manually adjust the order of a rule, simply highlight the rule and use the Up and Down buttons to move it to the proper placement Rule Editor The Rule Editor window is used for creating new rules or editing existing rules.

35 34 Name - You can name a rule using any characters without restriction or character count limit. Rule names are for your use and identification only, and have no impact on functionality. Browsium recommends using rule names that clearly describe what the rule is used for, so it can be easily identified in the Rules Manager display. Enable (checkbox) - All rules are enabled by default when created. Some rules may contain complex parameters or complex paths and it may be more practical to simply disable a rule rather than remove it if the rule is not needed or to test ordering behaviors, etc. In addition, some users may choose to keep only a single rule set and want to disable a specific rule for some given period of time. To disable a rule, click the checkbox to remove the check or click the checkbox next to the rule name in the Rules Manager. Match Method Most rules require a simple string match of the URL in order to trigger Catalyst to direct the navigation to the chosen browser. Some complex URL configurations require advanced pattern matching techniques, so Catalyst provides the ability to match based on regular expressions (RegEx) if needed. You may also use Zone as the match method so that rules are triggered based on the Internet Explorer Zone of the target web application. Value This field contains the string or integer to conditionally match for a Catalyst rule to be triggered. If Match Method is set to Zone, the Value field will change to a dropdown menu containing Computer, Internet, Local Intranet, Restricted Sites, and Trusted Sites. Starting Browser This field determines which browser will evaluate the rule. The default is Any, meaning all browsers running the Catalyst extension will evaluate the rule. A specific Starting Browser can be chosen so that Catalyst will evaluate the rule in that specific browser. Starting Action This field defines the Starting Browser navigation behavior. Same Page instructs the Starting Browser to cancel the desired navigation and remain on the current page,

36 35 while opening the new URL in the Target Browser. Redirect navigates the Starting Browser to a redirection page (which can be customized by Catalyst admins), informing users as to why their navigation action opened in a different browser. Close Tab closes the Starting Browser tab (or entire browser if only one tab is open) as it navigates the Target Browser to the desired URL. Target Browser This field defines desired browser that will load the web page when the rule is triggered by the navigation action performed by the end user. When Target Browser is set to None, the navigation action will be aborted, effectively blocking end user access to that URL. When Target Browser is set to Any, the matching URL will be allowed in every browser, even those that have Block Other Requests enabled. Target Action This field defines the Target Browser navigation behavior. New Tab opens the page in a new tab. New Window opens the page in a new window. New Session opens the page in the specified browser using a new user session Project Settings Node The Project Settings Node gives you the ability to edit global settings for Catalyst configurations. These settings encompass features such as the Splash Screen behavior, Default Browser behavior and choice, and the location of custom redirection messages. Show Splash Screen on Start By default, Catalyst disables showing the splash screen (Catalyst graphic with the product name and version number) on client systems when the Controller is started. This option can be enabled during project configuration. The splash screen is only displayed at startup (usually set to user login) so users should not regularly see this display.

37 36 Override Default Defines whether Catalyst should override the default browser setting on the system, making Catalyst the default handler of HTTP and HTTPS traffic. It is checked by default, and must be checked for Catalyst to seamlessly handle navigation from desktop shortcuts and links in s. However, if it is unchecked, Catalyst rules will still be honored as long as the Catalyst extension is running in the default browser. Default Browser Allows an administrator to define the default browser (as defined by Catalyst) to be used for desktop shortcuts and links in s when no rule exists. This setting also defines the default Target Browser for new rules. Custom Redirect URL Enables administrators to specify the URL for a custom webpage that will be displayed when a rule includes Starting Action = Redirect. By default, Catalyst will use catalyst_redirect.html which is automatically installed in the Catalyst Program Files directory. Project Update Activation Project Update Activation enables new Catalyst configurations to be loaded on the fly without restarting the Catalyst Controller (which typically requires a reboot or logoff/logon of the client computer). The field can be set to load the new configuration immediately (the default), at a scheduled time, or upon next Catalyst Controller restart. Custom Catalyst Preferences Provides the ability to extend Catalyst functionality to support additional features and settings that may be needed for certain environments. Most customers will not need to use these optional values. Custom Catalyst Preference Catalyst.IEAddonDetectRedirects = true Catalyst.IEAddonNoZoneHopRecovery = true Description When this flag is set to true, Internet Explorer will detect 30x redirection (typically a 302 redirect) and evaluates rules on the redirected URL. By default, 30x redirected URLs are ignored. There are two different "Same page" starting action behaviors implemented in the Catalyst Internet Explorer extension when navigating between zones. Default behavior is to detect a zone hop and navigate back to the last page in the history of the starting browser. However, this functionality is unreliable in some environments where Internet Explorer s travel log API is incorrectly providing incomplete travel log information. For such cases an alternate zone hop behavior was implemented that leaves Internet Explorer at "about:blank" page after a zone hop. This alternate behavior can be invoked by setting this flag to true.

38 37 Section Four Configuration Tutorial In this section you will learn: How to create and test a Catalyst project

39 38 4. Configuration Tutorial Once the Browsium Catalyst Configuration Manager and Browsium Catalyst Client installation is complete, you can begin configuring which sites to load in the desired browser. The Browsium Catalyst Configuration Manager is provided as a simple tool to create and manage the rules and settings that govern Catalyst behavior. Its output is a Catalyst project (or configuration), which instructs the Catalyst Client to take action. It s critical to enable the Catalyst extensions within Internet Explorer, Chrome, and Firefox before proceeding with this tutorial. Most modern browsers require users to manually enable the extensions, instead of enabling them by default when they re installed by anther program rather than from an extension gallery within the browser. This process is also known as sideloading. Read section Managing the Catalyst Client Software to learn how to deploy the Catalyst Client throughout your enterprise and centrally enable the extensions. Systems must have the Catalyst Client installed, with all extensions enabled, to test or use the configurations created in the Catalyst Configuration Manager. Windows 8 and later do not allow any program to set the default browser. If you re testing or running this tutorial on Windows 8 and later, be sure to read section Readying Windows 8 and later for Catalyst. This section will also provide guidance for deploying Catalyst throughout an enterprise running Windows 8 and later, as steps must be taken to configure Catalyst as the default browser on every PC Create and Test a Project Catalyst offers a few ways to deliver powerful options for rule matching in order to meet the specific needs of your environment. In this tutorial, we will create a new project, add a rule, and then test the configuration by simulating a client deployment. We ll do all of this on a single system running both Catalyst Configuration Manager and Catalyst Client. For this example, we have identified a website, which must be opened using Internet Explorer it will not work properly in any other browser. To create the rules needed for the YouRang site, use the following steps: 1. Open the Catalyst Configuration Manager. A new project is created by default. There are a variety of ways to open existing project files, but this section of the guide assumes this

40 39 is your first time creating a Catalyst project. Therefore, we ll have you start building your configuration from an empty, new project. 2. Begin by naming your project Catalyst test project and give it the description My first project. Click the Rules Manager, click the Add Rule link in the Actions pane to bring up the Rule Editor screen. Start by entering a name for the rule. Rule names are friendly names for organizational and identification purposes only and have no effect on the behavior of a rule. For this example, we will choose YouRang Portal. 3. Keep the Enable checkbox selected to ensure the rule is active and Catalyst will trigger when the proper conditions are met. 4. Select a Match Method from the dropdown menu. There are three Match Method options for ensuring the rule is triggered when desired conditions are met. The Simple

41 40 method does a simple string match of the URL against the text in the Value field. The RegEx method is provided for scenarios that require a set of complex matching criteria. Zone will match the Internet Explorer Zone of the target website. Most rules will only need the Simple method. For this example, we will leave everything set to the default 5. Enter a Value to check for rule matching conditions. For this example, we will use yourang.us to match our portal site. 6. The Starting Browser option allows administrators to define if the user must initiate a rule action from a specific browser, or if the rule should be triggered regardless of which browser is active at the time. The default value for this setting is ANY to ensure the broadest rule coverage.

42 41 7. Catalyst provides the ability for administrators to control the user experience behavior when a rule is triggered. Administrators can set Catalyst to leave the user on the same page, redirect them (and display a redirection notice page) or close the active tab. By default the Starting Action option is set to Same Page to avoid interrupting the user activity and simply leaving the user at their last successful navigation. 8. The Target Browser setting defines which browser is loaded when the rule conditions are met. By default, this value is set to the Default Browser value listed in the Project Settings node in this case Microsoft Internet Explorer. Administrators should set this value to the desired browser. If the purpose of the rule is to block navigation (e.g. for security purposes), simply set the value to NONE. For this example, we will load the YouRang portal in Microsoft Internet Explorer.

43 42 9. The final rule option is Target Action. Catalyst offers the ability to granularly control browser behaviors when loading content, offering the ability to load sites in a new tab, new window or new session. By default, the Target Action value is set to New tab. For this example, we ll stay with the default New tab. 10. When you are done creating the rule, click OK to save the rule to the Rules Manager.

44 For our Catalyst test project, we don t need to modify any browsers in the Browser Manager or the Project Settings. We will leave everything at its default value. 12. Now we re ready to test our configuration. Using the Start Test Configuration menu option will prompt you to save the project file and then immediately and automatically apply project file pointers directly in the system registry and start the Catalyst Controller to process the new configuration. Projects should be saved regularly to ensure work is not accidently lost. Catalyst Configuration Manager does not auto-save work in progress, other than when Start Test Configuration is executed. Once Start Test Configuration has been executed, Catalyst Controller will display the Splash Screen to inform you that the Controller has started. Note that this occurs even though our configuration has the Show Splash Screen on Start setting unchecked (as it is by default). This is because Catalyst Configuration Manager will always override this setting when it starts the Controller during project development and testing. 13. After the test configuration has been started, you may want to confirm that the Catalyst processes are all running by viewing them in the Task Manager. The key processes are BrowsiumCatalystController.exe and BrowsiumCatalystMonitor.exe. Those will only run when the Controller is running with a valid Catalyst configuration.

45 44 BrowsiumCatalystChromeProxy.exe is part of the Catalyst Chrome extension and always runs when the Catalyst Client is installed. BrowsiumCatalystManager.exe is the Catalyst Configuration Manager and only runs when the Manager application is running during project development and testing. 14. Now that we ve confirmed all process are running correctly, it s time to test the configuration in our browser. Simply open Chrome (or Firefox) and enter the URL in the address bar. Catalyst will automatically stop the navigation in your Chrome and open Internet Explorer to the YouRang site.

46 45 Section Five Catalyst Deployment in the Enterprise In this section you will learn: How to use Group Policy to manage Catalyst extension settings for each browser To automatically enable and lock down the Catalyst extensions on remote systems To configure other settings to improve the Catalyst experience for end users

47 46 5. Catalyst Deployment in the Enterprise To provide maximum flexibility for managing enterprise deployments, Catalyst supports a variety of methods for hosting configuration (browsers, rules, and settings) locations. In this section, we ll examine the available options, provide recommendations, explain the loading/caching behaviors and offer specific deployment guidance for typical enterprise scenarios. The Catalyst Client configuration is read from a project file a single, XML-formatted data file containing the entire Catalyst configuration. The file can be pushed out to a known location on end user PCs, stored at a shared network location, or hosted at an easily accessible URL. The project file can be updated easily and separately from the Catalyst executable code, making ongoing support and maintenance easy to integrate into existing organizational processes. Each client system must be made aware of the location of the Catalyst project file containing the configuration that is relevant to that user s web applications. Your organization may use one configuration for all end users, or have separate configurations for various departments or geographic locations. A client system loads its Catalyst configuration by reading a file path from the LoadFromFileName registry value. As a Catalyst administrator, you must determine the best way to deploy this registry value and data to your organization. You can do this using a variety of methods, ranging from scripted registry editors to Group Policy. Many organizations prefer to use Group Policy to deploy this registry value, particularly if different organization units require different configurations. The registry preference extension for Group Policy is often the most efficient way to streamline the deployment of the LoadFromFileName registry value and data. Another option is to use Browsium s ADM and ADMX templates, which can be easily customized for the location of your project file. These templates, with usage instructions, can be found in the Browsium Catalyst Knowledge Base. See section 5.4 for details on deploying Catalyst project files and LoadFromFileName registry pointers.

48 Understanding Catalyst Registry Setting Locations Before we look at deployment specifics for enterprise client systems, it is important to understand methodologies for deploying configurations on test systems during configuration development. Catalyst makes it easy to test a configuration without requiring a centralized deployment methodology. This is done via the Start Test Configuration option from the File menu of Catalyst Configuration Manager. This option will save the project file on disk, place a pointer to that file directly in the system registry, and start the Catalyst Controller to process the new configuration. The pointer is written to the LoadFromFileName registry value in HKEY_CURRENT_USER\SOFTWARE\Browsium\Catalyst. Start Test Configuration should only be used for project development and testing as it requires manual operation of Catalyst Configuration Manager which should never be made available to end users. In addition, this registry location should only be used for testing as it is easily overwritten by the Catalyst Configuration Manager and may not persist during a Catalyst Client upgrade. The last concept that must be understood before embarking on a Catalyst deployment is the precedence hierarchy for the evaluation of configurations when multiple LoadFromFileName values are found on a system. Catalyst follows this hierarchy to load the configuration that will be used on a given end user system (and on test systems). Once a valid configuration is found, Catalyst will stop searching and that configuration will be used. Deploying different Catalyst configurations using multiple methodologies on a single PC may cause unpredictable results as only the configuration highest in the hierarchy will be used. The following table provides the hierarchy of Catalyst configuration precedence. The string (Wow6432Node) in the registry path denotes the Wow6432Node registry key that will be included in the path on 64-bit Windows systems. 32-bit Windows systems do not contain this key, hence the use of parentheses in the example.

49 48 HKEY_LOCAL_MACHINE\Software\(Wow6432Node)\Policies\Browsium\Catalyst\LoadFromFileName (Catalyst Project file pointer for all user accounts, deployed via registry editor or Group Policy) HKEY_CURRENT_USER\Software\Policies\Browsium\Catalyst\LoadFromFileName (Catalyst Project file pointer for current user, deployed via registry editor or Group Policy) HKEY_CURRENT_USER\Software\Browsium\Catalyst\LoadFromFileName (Ion Project file pointer for current user testing only, deployed via Start Test Configuration) Catalyst 2.0 and earlier used a registry key called RulesFilePath. That key has been deprecated in Catalyst 3.0 and later. Only LoadFromFileName values will be used to determine the active Catalyst configuration. Contact Browsium Support if you need assistance upgrading from an older version of Catalyst Working with Test Configurations in Group Policy Environments Understanding the configuration loading hierarchy is an important part of ensuring test configurations will load as expected during project development. Testing on systems that are also configured with a LoadFromFileName value via Group Policy may cause issues when Start Test Configuration is applied. As noted in the section above, Catalyst reads LoadFromFileName from all other \Policies\Browsium\Catalyst locations prior to the Test Configuration location. Browsium recommends testing Catalyst on systems that are not controlled by Catalyst Group Policy settings to avoid configuration hierarchy conflicts. For example, if Group Policy is deploying a LoadFromFileName value in the location at the top of the configuration hierarchy, Start Test Configuration will generate an error as follows:

50 49 In order for Catalyst to read the LoadFromFileName value created by Start Test Configuration, an additional step is required to disable the value created by Group Policy. To disable the Group Policy loading behavior, open the Registry Editor and navigate to the key listed in the error message above, and remove or rename the LoadFromFileName value. You may find that changing the value of the registry key to LoadFromFileName-OFF is a convenient way to disable the registry value, rather than deleting it, while making that registry value s original intent clear. Making any small change in the key name will prevent Catalyst from reading the key value and therefore Catalyst will load only the test configuration as desired. When testing is complete, remember to revert the changes made using the Registry Editor or manually force a Group Policy update. Group Policy refresh rates may nullify the Registry changes when policies are refreshed and the managed keys are recreated. If this occurs when the Catalyst Controller is running, no changes will happen. If the Controller is restarted after the policies are refreshed, the Controller will read the higher level policy values which will result in the test configuration values failing to be read Multi-user Testing Configurations As mentioned previously, the Catalyst Configuration Manager should be installed only for administrators and project developers not for end users. The Start Test Configuration option can only be used for single user testing. The Start Test Configuration option only saves and loads the configuration for the current user. Start Test Configuration in Catalyst Configuration Manager does not support multi-user testing. This design cannot meet the requirement to perform extended testing with multiple users or business groups before enterprise wide deployment. Administrators looking to test a configuration with a group of users should follow the standard configuration deployment approach for their organization. Once the Catalyst project file is deployed, the Controller process must be restarted on each client system to load the new configuration. More information on deployment options, settings and configuration options can be found in the Deploying Catalyst Configurations section.

51 Managing the Catalyst Client Software It is important to develop a strategy to properly deploy and manage the Catalyst Client software on end user PCs. As part of your strategy, two important system configuration options should be considered. The first is to ensure the Catalyst browser extensions are enabled for all browsers on each client PC. It is recommended that you also block end users from disabling the Catalyst browser extensions once they ve been enabled. The second is to ensure that neither Internet Explorer, Chrome, nor Firefox are selected as the default browser or set to prompt to become the default Catalyst itself (actually the Catalyst Controller) must be the default so it can route all navigation to the appropriate browser. Catalyst will take over as the default browser automatically, every time the Controller starts. Many organizations utilize Group Policy to enforce settings on end user PCs. The alternative method for managing the enforcement of the browser settings for Internet Explorer is by adding or changing registry settings manually. To modify settings manually in the local PC registry, administrators will need to use a registry editor. The default Windows registry editor which must be launched from the Run command is regedit.exe. Administrative privileges are required to use the regedit.exe editor. These important system configuration options can be managed by Group Policy in both Internet Explorer and Google Chrome. Mozilla Firefox does not natively support Group Policy today Managing the Catalyst Extension for Internet Explorer This section will guide you through the various settings for Internet Explorer that can be managed in a Catalyst deployment Enable the Catalyst Add-on for Internet Explorer via Group Policy Recent versions of Internet Explorer require user confirmation before any new add-on (or extension) is enabled, unless that add-on is set to enabled during the deployment process. The most common way to enable the Browsium Catalyst Internet Explorer extension during deployment is by utilizing Group Policy to make the necessary registry changes on client PCs. Alternative methods to modify the registry on client PCs, such as using a registry editing tool, a Visual Basic Script or making the changes to the registry with software distribution tools.

52 51 Group Policy - Understanding the Add-on List Policy Administrators can control the use of specific add-ons through the add-on list policy. Administrators can choose to enable or disable an add-on as well as allow a specific add-on to be managed by the user. Policy Name: add-on list Path: User Configuration or Computer Configuration node; Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. To set this policy, an administrator can enable the policy and enter the GUID/CLSID of the Catalyst add-on to the Add-on List and set the value to 1. When you enter the GUID/CLSID, be sure to include the open brace at the beginning and the close brace at the end. For Catalyst 3.2 the GUID/CLSID is {45D99A69-B29C-47A E32C3E82A214}.

53 52 Determining the GUID/CLSID of the Catalyst Internet Explorer Extension After installing the Browsium Catalyst Client, go to the tools menu in Internet Explorer and choose Manage add-ons. You ll then be presented with the Manage Add-ons interface where you should see Browsium Catalyst Internet Explorer Extension in the list among the Toolbars and Extensions that are currently loaded in Internet Explorer. Right Click on the Browsium Catalyst Internet Explorer Extension and choose More Information from the dropdown menu. The CLSID, (Class ID) will appear in the dialog box.

54 53 Click the Copy button and then paste the contents of this dialog box (including the Class ID) to Notepad for later reference and save the text file. When you make the registry changes documented above, you will need to use the Class ID to identify the add-on in the policy. To set this policy with a manual or automated registry entry, an administrator can create a registry value based on the GUID/CLSID of the add-on in either of the following keys and then set the desired value: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CLSI D} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CLS ID} Each add-on is a value in this registry key with the following properties. Name: GUID of add on which is {45D99A69-B29C-47A E32C3E82A214} Type: REG_SZ Value: 0 - Add-on is disabled and cannot be managed by the end user. 1 - Add-on is allowed and cannot be managed by the end user.

55 54

56 55 The Add-on (CLSID) lists are empty by default Disable Internet Explorer s Default Browser Check By default, some versions of Internet Explorer will prompt the user to select it as the default browser. Since Catalyst becomes the default browser, you will want to prevent this behavior. With Group Policy settings and local registry settings, you can remove the ability for end users to change the default browser to Internet Explorer. Depending on which Group Policy template is on the system, this policy will vary. This policy allows you to prevent Internet Explorer from checking to see whether it is the default browser and prevents the user from changing it. Before you enable this policy, you will want to uncheck the box Tell me if Internet Explorer is not the default browser. The check box is on the Program tab in the Internet Options dialog box. You can uncheck the box with a registry setting in the HKCU hive. The path to the registry key is below. The value for Check Associations should be no. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Check_Associations"="no"

57 56 The Group Policy settings are listed below. All of them can be found at the following path: Path: User Configuration\Administrative Templates\Windows Components\Internet Explorer For IE8 & IE9: Policy Name: Prevent changing default browser check For IE10: Policy Name: Disable changing default browser check For IE11: Policy Name: Notify users if Internet Explorer is not the default web browser If you enable this policy, the Internet Explorer Should Check to See Whether It Is the Default Browser. Also, the check box on the Programs tab in the Internet Options dialog box appears dimmed and the user cannot change the default browser to IE. If you disable this policy or do not configure it, users can determine whether Internet Explorer will check to see if it is the default browser. When Internet Explorer performs this check, it prompts the user to specify which browser to use as the default.

58 Managing the Catalyst Extension for Google Chrome To ease your Group Policy setup, several templates can guide you through the configurable options. The Group Policy templates, and associated guidance are provided by Google and can be found on Google s support site. You may find additional settings (beyond those documented in this section) that you may wish to enforce or enable based upon your organization s preferences. Starting with Chrome 28, policies are loaded directly from the Group Policy API on Windows. Policies manually written to the Windows registry will be ignored. See for details Enable the Catalyst Extension for Chrome via Group Policy By default, Chrome automatically disables all extensions that are side-loaded (installed by a 3 rd party program, like the Catalyst Client installation package), requiring users to enable them manually. The only way to centrally enable the Catalyst Extension for Chrome for enterprise deployment is via Group Policy for domain-joined systems. The policy Configure the list of force-installed extensions (a.k.a. ExtensionInstallForcelist) allows you to specify a list of extensions that will be installed silently and enabled by default, without user interaction. This policy also works for side-loaded extensions, effectively overriding the default behavior in Chrome. Each item of the list is a string that contains an extension ID and an update URL, separated by a semicolon (;). The extension ID is the 32-letter string found e.g. on chrome://extensions when in Developer mode. The update URL must point to an Update Manifest XML document as described at Note that the update URL set in this policy is only used for the initial installation; subsequent updates of the extension will use the update URL indicated in the extension's manifest. For each item, Google Chrome will retrieve the extension specified by the extension ID from the update service at the specified update URL and silently install it. Users will be unable to uninstall extensions that are specified by this policy. If you remove an extension from this list, it will be automatically uninstalled by Google Chrome. Extensions specified in this list are also automatically whitelisted for installation; the Configure extension installation blacklist (a.k.a. ExtensionInstallBlackList) does not affect them.

59 58 A by-product of the ExtensionInstallForceList policy is that managed extensions are silently installed in Chrome, enabled by default, and block users from disabling or removing them. This is desired for enterprise deployment of Catalyst. If this policy is Not Configured, users can delete any extension in Chrome, including Catalyst, from the Extensions page. This is undesirable, as side-loaded extensions that are deleted are automatically blacklisted and re-enabling them is tricky (but achievable). Contact Browsium Support if this happens. To force-enable the Catalyst Extension for Chrome, and lock it down so users can t disable or delete it, you will use the Configure the list of force-installed extensions policy. This process requires an XML Manifest, which references the Catalyst extension s.crx file. Both must be available on a server or in the Chrome web store. Browsium is hosting these files for all customers on browsium.com. Follow these steps to ensure that this method is properly configured using Group Policy for your domain-joined systems. These instructions assume you re using the ADM template. The Group Policy location will change if using ADMX. As of Chrome 33, the ExtensionInstallForceList policy is only enforced for domainjoined systems. All client PCs in your environment must be joined to a Windows domain or you will not be able to centrally manage the Catalyst Chrome extension. Attempting to configure ExtensionInstallForceList via the Local Policy Editor will result in unpredictable behavior of the Catalyst Chrome extension. 1. Install Catalyst Client software. 2. Download the Group Policy templates for Chrome from the Google support site. 3. Import the Google Chrome Group Policy template into your Group Policy editor. 4. Enable the policy Configure the list of force-installed extensions. 5. Enter the following value by selecting the Show button in the Options window and apply the setting. (This is the Catalyst extension ID followed by the URL for the manifest XML document, with no spaces in the string.) nfhhihlhepgakhgnijobelmpacmhgnid; 6. View the results on the Chrome Extensions page (chrome://extensions) and confirm the enterprise icon is present at the far right. The Catalyst Chrome extension may have a different version number from the other Catalyst components as Catalyst maintenance versions are released. See the version number section of the Catalyst Version History KB article for details on the release date and version number for the Catalyst Chrome extension.

60 Disable Chrome s Default Browser Check via Group Policy Group policy can be used to configure the default browser checks in Google Chrome and prevent users from changing them. If you Enable this setting, Chrome will always check on startup whether it is the default browser and automatically register itself if possible. If this setting is Disabled, Chrome will never check if it is the default browser and will disable user controls for setting this option (the desired state when using Catalyst). If this setting is Not Configured, Chrome will allow the user to control whether it is the default browser and whether user notifications should be shown when it isn't. For all users running Catalyst, the Set Chrome as Default Browser setting (a.k.a. DefaultBrowserSettingEnabled) should be Disabled in your Group Policy editor. The path for this setting in the Local Group Policy Editor is Local Computer Policy\Administrative Templates\Classic Administrative Templates (ADM)\Google\Google Chrome.

61 Managing the Catalyst Extension for Mozilla Firefox To use Group Policy to manage Firefox, you must first download the GPO for Firefox add-on which can be found at The next step is to download the ADM(X) template from Once the templates are imported into your Group Policy Editor, you can disable the default browser check as well as other settings you may find useful. Mozilla Firefox does not allow client software install an extension and enable it by default. Nor does it contain a centralized management facility to keep users from tampering with extensions like Internet Explorer and Chrome. However, Catalyst includes a facility to automatically enable the extension every time the user logs onto the system, so Catalyst administrators can ensure that the Catalyst extension is always enabled. To enable the Catalyst Extension for Firefox automatically, create the following registry value for 32-bit Windows systems: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Enable Catalyst Extension (REG_SZ) = "C:\Program files\browsium\catalyst\browsiumcatalystcontroller.exe" /ef for 64-bit Windows systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Enable Catalyst Extension (REG_SZ) = "C:\Program Files (x86)\browsium\catalyst\browsiumcatalystcontroller.exe" /ef Disable Firefox s Default Browser Check via Group Policy This policy configures the default browser checks in Mozilla Firefox and prevents users from changing them. If you enable this setting, Firefox will not check on startup whether it is the default browser and also will not allow the user to change this setting. For all users on a PC, the Disable Firefox Default Browser Check setting should be enabled in your Group Policy editor. The path for this setting is Local Computer Policy\Administrative Templates\Classic Administrative Templates (ADM)\Mozilla Firefox.

62 61 This setting will make the following changes to the PC s registry once the policy is propagated: Data type: REG_DWORD Windows registry location: HKEY_LOCAL_MACHINE\Software\Policies\Firefox\FirefoxCheckDefault Example value: 0x The value in this case should set be 0 Data type: REG_SZ Windows registry location: HKEY_LOCAL_MACHINE\Software\Policies\Firefox\FirefoxCheckDefaultType The value in this case should be Locked

63 Readying Windows 8 and later for Catalyst For Catalyst to work properly in all scenarios, it must be the default browser in Windows. In earlier versions of Windows, Catalyst was able to set itself the default browser. Microsoft has made significant changes with Windows 8 and later in this area which impacts all browsers, forcing users to take specific action or IT to manage default browser settings centrally. Prior to Windows 8, the Catalyst Controller automatically configured itself as the default browser, or more specifically, the default program for the HTTP and HTTPS protocols. This enabled Catalyst to direct traffic to the appropriate browser for desktop shortcuts and links to websites in applications, such as programs. With Windows 8 and later, Microsoft has blocked applications from programmatically configuring the default browser. Only end users (or IT administrators via Group Policy) can set a default browser. This is even true of Internet Explorer, which can only invoke the Set Default Programs control panel to when selecting Make Internet Explorer the default browser from Internet Options.

64 63 Because of these new restrictions in Windows 8 and later, default browser settings must be manually configured for Catalyst. The following sections will guide you through this process for two scenarios: Catalyst Project Development, which includes evaluation and testing of Catalyst Catalyst Enterprise Deployment, to set the default browser in a managed enterprise Set Catalyst as Default Browser for Project Development When developing Catalyst projects (or configurations), or simply evaluating Catalyst for future purchase, it s not practical to configure Group Policy to set Catalyst as the default browser on Windows 8 and later. Instead, it s much easier to set the default browser using the Default Programs control panel in Windows. After creating a project in Catalyst Configuration Manager and executing Start Test Configuration for testing, Catalyst will alert you that it wants to become the default browser in Windows assuming the Project Setting Override Default Browser is checked (which is the default setting in all projects). This works in much the same way as Internet Explorer, described in the prior section. Clicking OK in this dialog will automatically launch the Set Default Programs control panel. It will also start the Catalyst Controller so you will see the Catalyst Splash Screen while the control panel is loading.

65 64 You ll notice that Catalyst has 0 out of 2 defaults. You want it to have both defaults which correspond to HTTP and HTTPS. Select the option Set this program as default. Alternatively, to see the individual selections, select Choose defaults for this program and then choose Select All to set Catalyst as the default for both HTTP and HTPPS and then click Save.

66 65 Catalyst will hold these defaults until you change the settings by selecting another browser as the default if prompted. If you plan to continue to use Catalyst, you should not change the default browser, per the guidance earlier in section 5.2. Catalyst has a built-in fail-safe if the Controller is stopped, either manually or by the Clear Test Configuration option in Catalyst Configuration Manager, where it will restore Internet Explorer as the default program for HTTP, and HTTPS, even though the Default Programs control panel still shows Catalyst owning the setting for these protocols.

67 Set Catalyst as Default Browser for Enterprise Deployment When deploying Catalyst across an enterprise running Windows 8 and later, you will want to use enterprise-class management tools to set Catalyst as the default browser. Prior to Windows 8, applications could set the default handler for a file type/protocol by manipulating the registry. This means IT could easily have a script or a Group Policy manipulating the registry. For example, for the mailto: protocol, you just needed to change the default value under HKEY_CLASSES_ROOT\mailto\shell\open\command With Windows 8 and later, this method is no longer available. But Microsoft has introduced a new Group Policy mechanism for declaring these defaults in Windows 8 and later to accommodate this type of scenario. The basic idea is to have an XML file that maps programs to the file type/protocol that they should be the default for. The following steps provide guidance for configuring and deploying Catalyst as the default browser across an enterprise of Windows 8 or Windows 10 systems. This guidance is not required for Windows 7 or Windows XP as the Catalyst Controller is able to programmatically take over the default browser setting on those systems. 1. Create your XML file or export it from a system which has Catalyst as the default browser using DISM, per Microsoft s guidance. Among the many entries in your XML file, the following association identifiers must point to Catalyst. <?xml version="1.0" encoding="utf-8"?> <DefaultAssociations> <Association Identifier="http" ProgId="CatalystHTML" ApplicationName="Catalyst" /> <Association Identifier="https" ProgId="CatalystHTML" ApplicationName="Catalyst" /> </DefaultAssociations> 2. Use the new Windows 8 and later Group Policy that enables you to set the association for file types and protocols. Enable the policy Set a default associations configuration file found at Computer configuration\administrative templates\windows Components\File Explorer. This will set the following registry entry: <HKLM\Software\Policies\Microsoft\Windows\System!DefaultAssociationsConfiguration> This policy specifies the path for the XML file that can be either stored locally or on a network location.

68 67 Using DISM to import the XML is not enough; you must still link it to the Group Policy Object. In addition, the system needs to be domain-joined and the associations are applied at logon time.

69 Deploying Catalyst Configurations Since Catalyst is a client solution with no server component, getting the configuration settings to the client is critical for proper operation. Configuration management is extremely flexible and can be tailored to meet the design and requirements of your environment. Catalyst s project files are standard XML documents, allowing you to take full advantage of this versatile and very compact format. Configurations are easy to update by simply replacing the project file on end user systems, network share, or web server. By design, Catalyst will not look in any specific location for a project file you must configure where each client system will look for the configuration. This only needs to be done once, no matter how often the project file is updated, provided the file name and location do not change. The following steps provide guidance to specify where Catalyst should look for the project file. There are two options for deploying the Catalyst project file on each client system or hosted on a file share or web server. Browsium recommends using the hosted method for deploying configurations to provide the most flexibility. The Catalyst Client makes the network calls needed to pull down the configuration from the hosted project file, so no additional packaging or user login configuration steps are needed when using the hosted option. When using a project file loaded from a client system, administrators must use some other software distribution solution (SMS, SCCM, login script, file copy, etc.) to deploy the project file to the client file system Project File Deployment Option A: Network Share or Web Server Location In this section you will learn how to instruct Catalyst to load the configuration from a network share or web server location. To do this, you must edit the system registry manually (for local testing) or via a script or Group Policy (for remote deployment) to create the LoadFromFileName registry value and data at the appropriate location. Browsium recommends using the registry preference extension for Group Policy or the Browsium ADM and ADMX templates as the most efficient way to streamline deployment of this registry value. The Catalyst project file (.cax) must be stored in a user-readable location on the network share or web server. For network share locations, Browsium recommends users have only read access permissions to ensure the file is not accidently removed or modified. For web server locations, organizations must ensure users have both security credential and network access to the resource. For example, remote/mobile users will need to have VPN access if the web server

70 69 hosting the Catalyst project file is not publically accessible and the user s system has not cached the configuration from a prior connection. If the network share or web server is unavailable when the Controller starts, and no configuration is found in Catalyst s cache from a previous connection, the Controller will not start. As long as the user successfully connects to the server once during Controller startup, the configuration will be cached indefinitely. The following registry keys and associated values must be created, depending on the system and user accounts being targeted: For per-user settings on 32-bit or 64-bit Windows systems, find or create: HKEY_CURRENT_USER\Software\Policies\Browsium\Catalyst\ For per-machine settings on 32-bit Windows systems, find or create: HKEY_LOCAL_MACHINE\Software\Policies\Browsium\Catalyst For per-machine settings on 64-bit Windows systems, find or create: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Browsium\Catalyst Then create or populate the following String Value in the key: LoadFromFileName (REG_SZ) = \\Server\Share\Catalyst\... [the path to your Catalyst project file] This setting will direct the Catalyst software to the project file the next time the Catalyst Controller is restarted. Slashes in the file path must be escaped with a slash when invoking Regedit.exe via a.reg file. So \\Server\Share becomes \\\\Server\\Share. remains In this example, LoadFromFileName has been configured to use the Catalyst project file Catalyst test.cax in the \\server\share directory on a 64-bit Windows system. These entries can be scripted and delivered to the Registry on remote clients via the following text in a.reg file. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Browsium\Catalyst] "LoadFromFileName"="\\\\server\\share\\Catalyst test.cax"

71 Project File Deployment Option B: Client File System Location In this section you will learn how to instruct Catalyst to load the configuration file from a local file system location. To do this, you must edit the system registry manually (for local testing) or via a script or Group Policy (for remote deployment) to create the LoadFromFileName registry value and data at the appropriate location. Browsium recommends using the registry preference extension for Group Policy or the Browsium ADM and ADMX templates as the most efficient way to streamline deployment of this registry value. The Catalyst project file (.cax) must be stored in a user-readable location on the client PC. If not already on the client PC, administrators must have a distribution plan and process for ensuring the project file is copied to the client PC prior to starting the Catalyst Controller. If Catalyst is unable to find the project file in the defined location, and none exists in the cache from a previous configuration, the Catalyst Controller will not start. For more information on Catalyst file caching behaviors see the Catalyst Project File Caching Behavior section. The following registry keys and associated values must be created, depending on the system and user accounts being targeted: For per-user settings on 32-bit or 64-bit Windows systems, find or create: HKEY_CURRENT_USER\Software\Policies\Browsium\Catalyst\ For per-machine settings on 32-bit Windows systems, find or create: HKEY_LOCAL_MACHINE\Software\Policies\Browsium\Catalyst\ For per-machine settings on 64-bit Windows systems, find or create: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Browsium\Catalyst\ Then create or populate the following String Value in the key: LoadFromFileName (REG_SZ) = C:\directory\ [the path to your Catalyst project file] This setting will direct the Catalyst software to the configuration file the next time the Catalyst Controller is restarted. Slashes in the file path must be escaped with a slash when invoking Regedit.exe via a.reg file. So C:\directory becomes C:\\directory in the registry value. In this example, LoadFromFileName has been configured to use the file Catalyst test.cax in the C:\Browsium directory on a 64-bit Windows system. These entries can be scripted and delivered to the Registry on remote clients via the following text in a.reg file.

72 71 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Browsium\Catalyst] "LoadFromFileName"="C:\\Browsium\\Catalyst test.cax" 5.5. Verifying Deployment Settings Catalyst provides a command-line function to query the local system and identify location of the configuration to be used the next time the Controller starts. The command is BrowsiumCatalystController /WhichConfig, run from a standard Command Prompt. In the following example, a system is setup with a configuration deployed to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Browsium\Catalyst with the value C:\Browsium\Catalyst test.cax stored in LocalFromFileName. The query uses registry reflection so the result ignores the Wow6432Node key on 64-bit Windows systems although it s in the path of the registry value. Executing this command results in the configuration acknowledged as:

73 72 WhichConfig shows the configuration TO BE LOADED at the next Controller restart. The project file name shows shown may be different from the currently loaded configuration if the LoadFromFileName registry value has been changed since the last Controller restart. In addition to the command line option, administrators running the Catalyst Configuration Manager can quickly check which configuration will load when the Controller is restarted by viewing the About Box. Select About Browsium Catalyst Configuration Manager from the Help menu. When the Catalyst About Box loads, press the Ctrl key to reveal the project file information. In addition to the LoadFromFileName registry location and project file path and name, you will see the installed.net CLR version another way to ensure the system is ready and working properly for testing.

74 Understanding the Catalyst Project File Caching Process Catalyst reads the project file (configuration) when the Controller is started, then continues operating using that configuration until the Controller restarts and looks for a new project file. Browsium does not support dynamic updates to the active Catalyst configuration, as unpredictable behavior may result. To avoid end user complaints and helpdesk calls, Catalyst will not force close a browser for any reason. Organizations wanting to load a new configuration should instruct users to close all open browsers and restart the Catalyst Controller. Alternatively, organizations could use existing systems management tools to remotely perform the tasks, or wait for the users to logoff and logon again which will trigger the Catalyst Controller to load the new project file Catalyst Project File Caching Behavior Catalyst attempts to load the configuration from the project file defined in the LoadFromFileName registry value whenever the Controller is started. The location of the file can be local on the client system, a network share, or a web server. The Controller must be able to reach the location where the file is stored, and the user must have at least read permissions on the project file. When the configuration is loaded, a copy of the project file is cached locally in the user s AppData directory (or equivalent based on Windows version and user directory structure). If multiple users share the same PC with unique user accounts, or when using a multi-user terminal server, each user will cache a copy of the project file in his/her AppData directory. Those files will be identical if the LoadFromFileName registry value is in HKEY_LOCAL_MACHINE (one entry for all users), or may be different if LoadFromFileName is in HKEY_CURRENT_USER (unique entry per user). If the original project file is not available (the network location is temporarily unreachable or the file has been moved, renamed, or deleted), Catalyst will load the previously cached copy of the project file and operate using that configuration until the Controller is restarted and a new project file is available. This capability makes Catalyst extremely robust and able to remain fully functional regardless of what happens to the project file after it has been loaded and the Catalyst processes are running.

75 How Catalyst Handles Project File Polling Some customers deploy Catalyst in a staged rollout to their enterprise user base, which requires updating project files as redirection rules are required. To ensure client systems obtain the updated project file, Catalyst includes a configuration polling mechanism to check for modified versions of the project file. When Catalyst identifies a different file in the target location defined in the LoadFromFileName registry value, by comparing the MD5 hash of the cached file against the target file, the target file is retrieved and cached locally. If the hash matches the current cached file, the target project file is not retrieved. To ease deployment in large enterprises, Catalyst enables new configurations to be loaded on the fly without restarting the Catalyst Controller (which typically requires a reboot or logoff/logon of the client computer). This functionality is governed by Project Update Activation in Project Settings. The default is set to load the new configuration immediately. To achieve enterprise-level scale, the polling mechanism uses a random interval to discover configuration updates, as noted at the end of this section. It can therefore take up to an hour for Project Update Activation to change the in-memory configuration that Catalyst is actively using even when set to Immediately. This setting can be changed to activate the new project at a scheduled time or upon next Catalyst Controller restart.

76 75 When At a particular time is selected, a Project Update Time field is added. This field defaults to 2am but can be changed to any time value. It uses the client s system clock so that 2am is 2am for every user, regardless of time zone. The client polling mechanism checks the target project file location at a regular time sequence interval, using a randomly generated seed time point. The randomly generated seed value helps ensure large scale deployments do not simultaneously try to retrieve the project file, avoiding a denial of service or network traffic storm issues. Catalyst simply compares the computed MD5 hash of two files and uses the target file if the two signatures are different. No effort is made to determine which file is newer (either by time/date stamp or content analysis) so administrators must ensure updates to the target file location are done carefully to avoid clients regressing to an older project file configuration by mistake Managing Catalyst Logging Settings In a default installation, Catalyst logs Warning level information which will provide basic information about the configuration and any important errors that may occur on client systems. Catalyst can be configured to record more detailed logging information to troubleshoot problems or validate configuration settings on the local system. Catalyst logging is written to the standard Windows event log under an application-level source named Catalyst. The Logging Level setting determines the amount and type of data collected in the Windows event log. This table summarizes the various levels and data collected:

77 76 Value Level Description 1 Error Writes Error entries 2 Warning Writes Warn and Error entries (Default) 4 Info Writes Info, Warn and Error entries To adjust the level of logging, a registry value must be configured on the target system. Once the logging value is created, the Controller must be restarted to recognize the specified logging value. Catalyst looks in the Windows registry for the presence of the logging setting at HKEY_CURRENT_USER\Software\Browsium\Catalyst. The key is a REG_DWORD type, with value name LogLevel. The value of the key can be 1, 2 or 4 (see chart above). If no LogLevel registry value is present in the defined registry location (the default Catalyst Client state), or any invalid values are found at that location, Catalyst will revert to using the default Level 2 Warning.